Hackers Steal $540 Million in Crypto From ‘Axie Infinity’ Game

“The breach happened due to social engineering, not technical flaw,” said

Aleksander Larsen,

operating chief and co-founder of Sky Mavis. While users are now unable to withdraw or deposit funds to Ronin Network, he said Sky Mavis is committed to ensuring that all of the drained funds are recovered or reimbursed.

It was the second-largest crypto hack ever, according to analytics firm Elliptic. The assets were worth about $540 million on the date of the theft and are worth about $615 million now.

Sky Mavis shared a link that shows the stolen funds are still in the hacker’s wallet. The firm said it is working with the analytics firm Chainalysis to track the stolen funds. The news didn’t have a big impact on the price of ether, which was down 0.65% at $3,395.20 at 5 p.m. ET.

“We are working directly with various government agencies to ensure the criminals get brought to justice,” Ronin said in the statement. “We are in the process of discussing with Axie Infinity/Sky Mavis stakeholders about how to best move forward and ensure no users’ funds are lost.”

The hack comes as a blow to the crypto industry as it moves into the mainstream with Wall Street buy-in, celebrity endorsers and high-profile Super Bowl ads. The federal government is still weighing further regulations of digital assets.

“Axie Infinity,” launched in 2018, is part of a small but fast-growing number of so-called play-to-earn games. Also known as blockchain games, they largely center on the buying, trading and selling of virtual assets backed by nonfungible tokens, or NFTs. The games are considered an early foray into the metaverse, a more immersive future version of the internet where people are expected to work, learn and be entertained.

“Axie Infinity” had more than 1.7 million daily users in February, according to Sky Mavis. In it players collect digital pets called Axies that they use to compete in battles. They can sell and trade the creatures for digital currency. Some Axies are worth more than others.

Many developers of earn-to-play games are startups, but some of the game industry’s large, publicly traded companies have recently begun experimenting in the category, including “FarmVille” maker

Zynga Inc.

and “Assassin’s Creed” creator

Ubisoft Entertainment SA

.

Some industry executives have raised concerns about the security and value of NFTs in games, such as Microsoft Corp. gaming chief

Phil Spencer

and the head of “Fortnite” maker Epic Games Inc.,

Tim Sweeney.

Many gamers also are skeptical of the trend and worry that earn-to-play merely represents a cash-grab opportunity for developers.

The decentralized nature of crypto platforms, added with the ofttimes inexperience of the developers of those platforms, leaves plenty of vulnerabilities inside the code for hackers to exploit. Since 2011, there have been 226 hacking incidents—not including the “Axie Infinity” hack—that have led to the theft of $12.1 billion, research firm Crystal Blockchain estimates.

In 2021, there were a record 75 incidents that resulted in $4.25 billion being stolen, according to the firm. The largest crypto hack was in August 2021, when a DeFi protocol called PolyNetwork lost assets worth $611 million at the time of the hack.

One of the highest-profile hacks was the 2016 break-in of Bitfinex, which resulted in a loss of about $70 million worth of bitcoin at the time. In February, FBI agents seized the majority of the stolen funds, which had surged to a value of about $3.6 billion, and charged a Manhattan couple with laundering the stolen funds.

Write to Paul Vigna at paul.vigna@wsj.com and Sarah E. Needleman at sarah.needleman@wsj.com